trade-doc-consistency-free
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The documentation in
SKILL.mdincludes instructions for installing a payment dependency (@alipay/agent-payment) vianpx. This package is associated with a well-known technology organization and is used for platform-specific licensing. - [INDIRECT_PROMPT_INJECTION]: The skill ingest untrusted external text (trade documents) provided by the user via the
scripts/run.mjsentry point. While the analysis engine uses deterministic regular expressions to extract fields, the processing of raw external text presents a standard surface for indirect prompt injection common in diagnostic tools. - [COMMAND_EXECUTION]: The tool is designed to be executed via a command-line interface, reading local files provided by the user for analysis purposes. All file operations and logic in
scripts/engine/trade-doc-consistency.jsare performed using standard Node.js libraries without network connectivity.
Audit Metadata